SNI (Server Name Indication)

Without SNI, a server hosting many HTTPS sites on one IP would not know which certificate to present, because the HTTP Host header only arrives after the handshake. SNI solves this and is the basis for shared hosting, reverse proxies and CDNs.

If a request has no SNI, the server returns its default certificate, often the wrong one. This happens when testing with openssl s_client without -servername, with very old clients, or with monitoring checks that only target the IP.

In TLS 1.2 and 1.3 the SNI hostname is sent in plain text. Encrypted Client Hello (ECH) is meant to fix this but is not available everywhere yet.

Example